evolcore 0.0.1 → 0.0.3

package/dist/agents/gemini-runner.js

@@ -0,0 +1,666 @@
+/**
+ * Gemini Agent Runner
+ *
+ * Integrates Google Gemini CLI as a backend via subprocess.
+ * Each runQuery spawns `gemini -p` with --output-format stream-json,
+ * parsing the JSONL event stream into EvolCore AgentEvent.
+ *
+ * Architecture:
+ *   GeminiRunner  →  spawn `gemini -p ...`  →  stdout JSONL stream
+ */
+import { spawn } from 'child_process';
+import { createInterface } from 'readline';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+import { resolveGoogleConfig } from './baseagent.js';
+import { commandExists } from '../utils/cross-platform.js';
+import { GeminiSessionFileAdapter } from '../core/session/adapters/gemini-session-file-adapter.js';
+import { logger } from '../utils/logger.js';
+import { normalizePermissionMode } from '../core/permission/mode.js';
+import { workspaceContainsHClassPaths } from '../core/protected-paths.js';
+import { buildBubblewrapCommand } from '../core/permission/sandbox-runtime.js';
+// Strip ANSI escape codes from Gemini CLI text output.
+// Gemini embeds raw terminal colors from tool stdout (e.g. vitest, npm)
+// into its assistant text, unlike Claude SDK which strips them internally.
+// eslint-disable-next-line no-control-regex
+const ANSI_RE = /\x1b\[[0-9;]*[a-zA-Z]|\x1b\].*?(?:\x1b\\|\x07)/g;
+function stripAnsi(text) {
+    return text.replace(ANSI_RE, '');
+}
+// ── MIME → 扩展名映射 ──
+const MIME_EXT = {
+    'image/png': '.png',
+    'image/jpeg': '.jpg',
+    'image/gif': '.gif',
+    'image/webp': '.webp',
+};
+// ── Gemini 模型列表 ──
+const GEMINI_MODELS = [
+    'gemini-2.5-pro',
+    'gemini-2.5-flash',
+    'gemini-2.5-flash-lite',
+];
+const GEMINI_READONLY_TOOLS = [
+    'read_file', 'list_directory', 'glob', 'grep_search', 'google_web_search',
+    'codebase_investigator', 'cli_help', 'get_internal_docs', 'update_topic', 'complete_task',
+];
+const GEMINI_AUTO_TOOLS = [
+    ...GEMINI_READONLY_TOOLS,
+    'write_file', 'replace', 'web_fetch', 'activate_skill',
+];
+const GEMINI_UNATTENDED_INTERACTION_TOOLS = new Set([
+    'ask_user',
+    'ask_user_question',
+    'request_user_input',
+    'exit_plan_mode',
+    'plan_approval',
+]);
+function normalizeGeminiToolName(toolName) {
+    return toolName
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .replace(/[^a-zA-Z0-9]+/g, '_')
+        .replace(/^_+|_+$/g, '')
+        .toLowerCase();
+}
+function isGeminiUnattendedInteraction(toolName) {
+    return GEMINI_UNATTENDED_INTERACTION_TOOLS.has(normalizeGeminiToolName(toolName));
+}
+function isGeminiPermissionDenial(event) {
+    const status = typeof event.status === 'string' ? event.status.trim().toLowerCase() : '';
+    if (['denied', 'rejected', 'blocked', 'permission_denied', 'policy_denied', 'not_allowed'].includes(status)) {
+        return true;
+    }
+    const decisions = [
+        event.decision,
+        event.permissionDecision,
+        event.policyDecision,
+        event.metadata?.decision,
+        event.metadata?.permissionDecision,
+        event.metadata?.policyDecision,
+    ];
+    if (decisions.some(value => typeof value === 'string'
+        && ['deny', 'denied', 'reject', 'rejected', 'block', 'blocked', 'not_allowed']
+            .includes(value.trim().toLowerCase()))) {
+        return true;
+    }
+    const codes = [event.code, event.reasonCode, event.error?.code, event.error?.type, event.error?.name]
+        .filter((value) => typeof value === 'string')
+        .map(value => value.toLowerCase());
+    if (codes.some(value => /(?:permission|policy|approval).*(?:deny|reject|block|not.?allowed)|(?:deny|reject|block).*(?:permission|policy|approval)/i.test(value))) {
+        return true;
+    }
+    const details = [event.output, event.message, event.reason, event.error?.message]
+        .filter((value) => typeof value === 'string');
+    if (details.some(value => /^permission denied[.!]?$/i.test(stripAnsi(value).trim()))) {
+        return true;
+    }
+    const detail = details.join(' ');
+    return /(?:\btool\b.{0,80}\bis not (?:allowed|permitted|authorized)\b|not (?:allowed|permitted|authorized).{0,80}(?:policy|approval)|(?:denied|rejected|blocked).{0,80}(?:by|under|due to).{0,40}(?:policy|approval)|(?:policy|approval).{0,80}(?:denied|rejected|blocked)|(?:approval|confirmation).{0,80}required.{0,80}(?:headless|non[- ]interactive))/i.test(detail);
+}
+const GEMINI_H_CLASS_PATTERNS = [
+    String.raw `evolcore\.json`,
+    String.raw `agents[/\\]defaults\.json`,
+    String.raw `agents[/\\]defaults_\d+\.json`,
+    String.raw `agents[/\\][^/\\"]+[/\\]config\.json`,
+    String.raw `agents[/\\][^/\\"]+[/\\]contact\.json`,
+    String.raw `agents[/\\][^/\\"]+[/\\]relations[/\\][^/\\"]+[/\\]config\.json`,
+    String.raw `backups[/\\]config`,
+    String.raw `\.snapshots`,
+    String.raw `(?:^|[/\\"])CA(?:[/\\"]|$)`,
+    String.raw `(?:AIDs|aids)[/\\][^/\\"]+[/\\](?:cert|keys)`,
+    String.raw `(?:^|[/\\"])\.device_id(?:[/\\"]|$)`,
+    String.raw `(?:^|[/\\"])\.env(?:[/\\"]|$)`,
+    String.raw `(?:^|[/\\"])\.seed(?:[/\\"]|$)`,
+    String.raw `(?:^|[/\\"])\.seed\.[^/\\"]+`,
+    String.raw `(?:^|[/\\"])\.migrated-[^/\\"]+`,
+    String.raw `(?:^|[/\\"])\.lock(?:[/\\"]|$)`,
+    String.raw `(?:^|[/\\"])daemon\.pid(?:[/\\"]|$)`,
+    String.raw `\.json_`,
+    String.raw `\.json\.migrated`,
+];
+const GEMINI_L_CLASS_PATTERNS = [
+    String.raw `data[/\\]triggers(?:[/\\]|$)`,
+];
+const GEMINI_L_CLASS_WRITE_TOOLS = [
+    'write_file', 'replace', 'delete_file', 'move_file', 'rename_file',
+];
+const GEMINI_EC_COMMAND_PATTERNS = [
+    String.raw `"command":"[ ]*ec[ ]*"`,
+    // This is only a shell-process boundary. It deliberately does not inspect
+    // subcommands or arguments. Shell composition remains excluded because the
+    // Gemini policy exception applies to the whole run_shell_command call.
+    String.raw `"command":"[ ]*ec[ ]+(?:[^"\\;&|$()<>\x60\r\n]|\\")*"`,
+];
+export function resolveGeminiPermissionProfile(value) {
+    const normalized = normalizePermissionMode(value);
+    if (normalized.mode === 'auto')
+        return { mode: 'auto', approvalMode: 'auto_edit' };
+    if (normalized.mode === 'request' || normalized.mode === 'bypass') {
+        return { mode: 'readonly', approvalMode: 'plan', degradedFrom: normalized.mode };
+    }
+    return { mode: 'readonly', approvalMode: 'plan' };
+}
+function appendGeminiPolicyRule(lines, toolName, decision, priority, argsPattern) {
+    lines.push('[[rule]]');
+    lines.push(`toolName = ${Array.isArray(toolName) ? JSON.stringify(toolName) : JSON.stringify(toolName)}`);
+    if (argsPattern)
+        lines.push(`argsPattern = '${argsPattern}'`);
+    lines.push(`decision = "${decision}"`);
+    lines.push(`priority = ${priority}`, '');
+}
+export function buildGeminiAdminPolicy(profile) {
+    const lines = [];
+    // EC/daemon owns all command semantics and authorization. The Runner only
+    // admits a single EC process through the otherwise mode-specific shell
+    // policy. Keep this above path denies so `--file` is not reinterpreted here.
+    for (const pattern of GEMINI_EC_COMMAND_PATTERNS) {
+        appendGeminiPolicyRule(lines, 'run_shell_command', 'allow', 1000, pattern);
+    }
+    // H-class protection is mode-independent and applies to built-in and MCP tools.
+    for (const pattern of GEMINI_H_CLASS_PATTERNS) {
+        appendGeminiPolicyRule(lines, '*', 'deny', 999, pattern);
+    }
+    for (const pattern of GEMINI_L_CLASS_PATTERNS) {
+        appendGeminiPolicyRule(lines, GEMINI_L_CLASS_WRITE_TOOLS, 'deny', 998, pattern);
+    }
+    if (profile.mode === 'readonly') {
+        appendGeminiPolicyRule(lines, GEMINI_READONLY_TOOLS, 'allow', 950);
+        appendGeminiPolicyRule(lines, '*', 'deny', 900);
+        return lines.join('\n');
+    }
+    appendGeminiPolicyRule(lines, 'run_shell_command', 'deny', 970);
+    appendGeminiPolicyRule(lines, 'ask_user', 'deny', 960);
+    appendGeminiPolicyRule(lines, GEMINI_AUTO_TOOLS, 'allow', 950);
+    // Gemini headless policy does not expose a stable MCP-only matcher. Keep
+    // explicit shell/interaction and protected-path denies above, then inherit
+    // unconfigured and bundled MCP tools instead of rejecting unknown names.
+    appendGeminiPolicyRule(lines, '*', 'allow', 900);
+    return lines.join('\n');
+}
+export function buildGeminiPermissionArgs(profile, policyPath, externallySandboxed = false) {
+    return [
+        '--admin-policy', policyPath,
+        ...(!externallySandboxed ? ['--sandbox'] : []),
+        `--approval-mode=${profile.approvalMode}`,
+    ];
+}
+function standardGeminiAdminPolicyDirectory() {
+    if (process.platform === 'win32') {
+        const programData = process.env.ProgramData;
+        return programData ? path.join(programData, 'gemini-cli', 'policies') : undefined;
+    }
+    if (process.platform === 'darwin') {
+        return '/Library/Application Support/GeminiCli/policies';
+    }
+    return '/etc/gemini-cli/policies';
+}
+export function hasStandardGeminiAdminPolicy() {
+    const directory = standardGeminiAdminPolicyDirectory();
+    if (!directory)
+        return false;
+    try {
+        return fs.readdirSync(directory, { withFileTypes: true })
+            .some(entry => entry.isFile() && entry.name.endsWith('.toml'));
+    }
+    catch {
+        return false;
+    }
+}
+// ── Gemini Runner ──
+export class GeminiRunner {
+    name = 'gemini';
+    capabilities = { clear: true, compact: false, fork: false, forkAtTurn: false, askUserQuestion: false, planApproval: false, fileRewind: 'unsupported' };
+    resolved;
+    model;
+    activeProcesses = new Map();
+    activeStreams = new Map();
+    activeSessions = new Map(); // sessionId → geminiSessionId
+    onSessionIdUpdate;
+    currentMode = 'readonly';
+    permissionContexts = new Map();
+    constructor(config, callbacks) {
+        this.resolved = resolveGoogleConfig(config);
+        this.model = this.resolved.model;
+        this.onSessionIdUpdate = callbacks.onSessionIdUpdate;
+    }
+    // ── ModelSwitcher ──
+    setModel(model) { this.model = model; }
+    getModel() { return this.model; }
+    listModels() { return GEMINI_MODELS; }
+    // ── Effort (not applicable) ──
+    setEffort(_effort) { }
+    getEffort() { return undefined; }
+    // ── Permission ──
+    setMode(mode) { this.currentMode = normalizePermissionMode(mode).mode; }
+    getMode() { return this.currentMode; }
+    listModes() {
+        return [
+            { key: 'readonly', nameZh: '只读', description: '只读操作自动执行，写入直接拒绝', available: true },
+            { key: 'auto', nameZh: '自动', description: '常规操作自动执行，危险操作自动拒绝', available: true },
+            { key: 'request', nameZh: '审批', description: '默认能力自动执行，缺失能力进入人工审批', available: false, unavailableReason: 'Gemini headless 不提供审批回调；请使用 ACP 集成' },
+            { key: 'bypass', nameZh: '放行', description: '沙箱内能力自动执行，仅硬边界不可绕过', available: false, unavailableReason: 'Gemini headless 不提供审批回调；请使用 ACP 集成' },
+        ];
+    }
+    setSendPrompt(_fn) { }
+    setPermissionGateway(_gw) { }
+    setPermissionContext(sessionId, context) {
+        this.permissionContexts.set(sessionId, context);
+    }
+    buildAgentEnv(sessionId, runtimeEnv) {
+        const env = {
+            ...process.env,
+            EVOLCORE_SESSION_ID: sessionId,
+            ...(runtimeEnv ?? {}),
+        };
+        if (this.resolved.apiKey)
+            env.GOOGLE_API_KEY = this.resolved.apiKey;
+        return env;
+    }
+    // ── Stream management ──
+    registerStream(key, stream) {
+        this.activeStreams.set(key, stream);
+    }
+    cleanupStream(key) {
+        this.activeStreams.delete(key);
+        this.activeProcesses.delete(key);
+    }
+    hasActiveStream(key) {
+        return this.activeStreams.has(key) || this.activeProcesses.has(key);
+    }
+    // ── Core: runQuery ──
+    async runQuery(sessionId, prompt, projectPath, initialAgentSessionId, images, systemPromptAppend, sessionManager, modelOverride, runtimeEnv) {
+        let geminiSessionId = initialAgentSessionId || this.activeSessions.get(sessionId);
+        // per-call 权限模式/模型：优先 override，缺省回落实例级（多会话并发互不污染）
+        const requestedPermissionMode = modelOverride?.permissionMode || this.currentMode;
+        const permissionProfile = resolveGeminiPermissionProfile(requestedPermissionMode);
+        const callModel = modelOverride?.model || this.model;
+        const geminiHome = path.join(os.homedir(), '.gemini');
+        fs.mkdirSync(geminiHome, { recursive: true, mode: 0o700 });
+        const sandboxProbe = buildBubblewrapCommand(this.resolved.cliPath, [], {
+            projectPath,
+            writablePaths: [geminiHome],
+        });
+        if (!sandboxProbe && workspaceContainsHClassPaths(projectPath)) {
+            throw new Error('Gemini 缺少可用的路径级隔离运行时，且项目覆盖 EvolCore 受保护根；已拒绝启动本轮任务');
+        }
+        // Build CLI args
+        const args = [];
+        // Only inject system context on first turn (no resume).
+        // Resumed sessions already have the context from the first turn;
+        // repeating it pollutes the conversation history.
+        let fullPrompt = prompt;
+        if (systemPromptAppend && !geminiSessionId) {
+            fullPrompt = prompt + '\n\n--- [SYSTEM_PROMPT_END] ---\n' + systemPromptAppend;
+        }
+        // Handle images: write to temp files, prepend @file references
+        const tempFiles = [];
+        {
+            if (hasStandardGeminiAdminPolicy()) {
+                throw new Error('Gemini 系统级 admin policy 会忽略 EvolCore 的临时安全策略，已拒绝启动本轮任务');
+            }
+            const policyPath = path.join(os.tmpdir(), `evolcore-gemini-permission-${crypto.randomUUID()}.toml`);
+            fs.writeFileSync(policyPath, buildGeminiAdminPolicy(permissionProfile), { mode: 0o600, flag: 'wx' });
+            tempFiles.push(policyPath);
+            args.push(...buildGeminiPermissionArgs(permissionProfile, policyPath, !!sandboxProbe));
+        }
+        if (images?.length) {
+            const tmpDir = os.tmpdir();
+            const fileParts = [];
+            for (let i = 0; i < images.length; i++) {
+                const img = images[i];
+                const ext = MIME_EXT[img.mimeType || ''] || '.jpg';
+                const tmpPath = path.join(tmpDir, `evolcore-gemini-img-${Date.now()}-${i}${ext}`);
+                fs.writeFileSync(tmpPath, Buffer.from(img.data, 'base64'));
+                tempFiles.push(tmpPath);
+                fileParts.push(`@${tmpPath}`);
+            }
+            fullPrompt = fileParts.join(' ') + ' ' + fullPrompt;
+            logger.info(`[GeminiRunner] Attached ${images.length} image(s) via @file reference`);
+        }
+        args.push('-p', fullPrompt);
+        args.push('--output-format', 'stream-json');
+        args.push('-m', callModel);
+        // Permission mode
+        if (permissionProfile.degradedFrom) {
+            logger.warn(`[GeminiRunner] permission mode ${permissionProfile.degradedFrom} is unavailable in headless mode; degraded to readonly`);
+        }
+        // Resume session
+        if (geminiSessionId) {
+            args.push('-r', geminiSessionId);
+        }
+        // Spawn subprocess
+        const env = this.buildAgentEnv(sessionId, runtimeEnv);
+        const sandboxedCommand = buildBubblewrapCommand(this.resolved.cliPath, args, {
+            projectPath,
+            writablePaths: [geminiHome],
+            readonlyPaths: tempFiles,
+        });
+        const child = spawn(sandboxedCommand?.command ?? this.resolved.cliPath, sandboxedCommand?.args ?? args, {
+            cwd: projectPath,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env,
+        });
+        this.activeProcesses.set(sessionId, child);
+        // Log stderr
+        child.stderr?.on('data', (data) => {
+            const msg = data.toString().trim();
+            if (msg)
+                logger.debug(`[GeminiRunner:stderr] ${msg}`);
+        });
+        return this.transformStream(child, sessionId, tempFiles);
+    }
+    // ── Event stream transformation ──
+    async *transformStream(child, sessionId, tempFiles) {
+        const pendingToolNames = new Map(); // toolId → toolName
+        const recordedDeniedToolIds = new Set();
+        const startTime = Date.now();
+        const rl = createInterface({ input: child.stdout });
+        // Build async queue from readline
+        const queue = [];
+        let resolve = null;
+        let rlClosed = false;
+        let processExited = false;
+        let exitCode = null;
+        // We need both rl 'close' AND child 'exit' before considering stream done.
+        // rl 'close' guarantees all buffered lines are emitted.
+        // child 'exit' gives us the exit code.
+        const isStreamDone = () => rlClosed && processExited;
+        rl.on('line', (line) => {
+            queue.push(line);
+            resolve?.();
+        });
+        rl.on('close', () => {
+            rlClosed = true;
+            if (isStreamDone())
+                resolve?.();
+        });
+        child.on('exit', (code) => {
+            processExited = true;
+            exitCode = code;
+            if (isStreamDone())
+                resolve?.();
+        });
+        // Handle race: process may have already exited before we registered the listener.
+        // Real ChildProcess sets exitCode (number) on exit; null means still running.
+        if (!processExited && child.exitCode != null) {
+            processExited = true;
+            exitCode = child.exitCode;
+        }
+        child.on('error', (err) => {
+            logger.error(`[GeminiRunner] Process error: ${err.message}`);
+            rlClosed = true;
+            processExited = true;
+            resolve?.();
+        });
+        try {
+            let done = false;
+            let accumulatedText = '';
+            // TextBuffer: accumulate streaming text tokens, flush as a single
+            // text event on boundary signals (tool_use / result / error / exit).
+            // Prevents StreamFlusher from splitting a single reply into multiple messages.
+            let textBuffer = '';
+            const flushTextBuffer = function* () {
+                if (textBuffer) {
+                    yield { type: 'text', text: stripAnsi(textBuffer) };
+                    textBuffer = '';
+                }
+            };
+            while (!done) {
+                // Process queued lines
+                while (queue.length > 0) {
+                    const line = queue.shift();
+                    if (!line.trim())
+                        continue;
+                    let event;
+                    try {
+                        event = JSON.parse(line);
+                    }
+                    catch {
+                        logger.debug(`[GeminiRunner] Non-JSON line: ${line.substring(0, 200)}`);
+                        continue;
+                    }
+                    switch (event.type) {
+                        case 'init': {
+                            // Extract session_id from init event
+                            const geminiId = event.session_id;
+                            if (geminiId) {
+                                this.activeSessions.set(sessionId, geminiId);
+                                this.onSessionIdUpdate?.(sessionId, geminiId);
+                                yield { type: 'session_id', sessionId: geminiId };
+                            }
+                            break;
+                        }
+                        case 'message': {
+                            // Skip user message echo
+                            if (event.role === 'user')
+                                break;
+                            // Assistant message (delta=true → streaming)
+                            // Accumulate into textBuffer; will flush on boundary event
+                            if (event.role === 'assistant' && event.content) {
+                                accumulatedText += event.content;
+                                textBuffer += event.content;
+                            }
+                            break;
+                        }
+                        case 'tool_use': {
+                            // Boundary: flush accumulated text before tool call
+                            yield* flushTextBuffer();
+                            const toolName = event.tool_name || 'unknown';
+                            if (event.tool_id) {
+                                pendingToolNames.set(event.tool_id, toolName);
+                            }
+                            yield {
+                                type: 'tool_use',
+                                name: toolName,
+                                input: event.parameters || {},
+                            };
+                            break;
+                        }
+                        case 'tool_result': {
+                            const toolName = (event.tool_id && pendingToolNames.get(event.tool_id))
+                                || (typeof event.tool_name === 'string' && event.tool_name)
+                                || 'unknown';
+                            if (event.tool_id)
+                                pendingToolNames.delete(event.tool_id);
+                            const requestId = typeof event.tool_id === 'string' || typeof event.tool_id === 'number'
+                                ? String(event.tool_id)
+                                : undefined;
+                            if (event.status !== 'success'
+                                && isGeminiPermissionDenial(event)
+                                && (!requestId || !recordedDeniedToolIds.has(requestId))) {
+                                if (requestId)
+                                    recordedDeniedToolIds.add(requestId);
+                                await this.recordUnattendedPolicyDenial(sessionId, toolName, requestId);
+                            }
+                            yield {
+                                type: 'tool_result',
+                                name: toolName,
+                                result: stripAnsi(event.output || ''),
+                                isError: event.status !== 'success',
+                            };
+                            break;
+                        }
+                        case 'result': {
+                            // Boundary: flush accumulated text before complete
+                            yield* flushTextBuffer();
+                            const durationMs = event.stats?.duration_ms || (Date.now() - startTime);
+                            const isError = event.status !== 'success';
+                            // Extract error message from event.error.message (Gemini CLI structure)
+                            const errorMessage = event.error?.message || event.message;
+                            yield {
+                                type: 'complete',
+                                result: accumulatedText || undefined,
+                                isError,
+                                errors: isError ? [errorMessage || event.status || '任务执行失败'] : undefined,
+                                durationMs,
+                                costUsd: undefined,
+                            };
+                            done = true;
+                            break;
+                        }
+                        case 'error': {
+                            // Boundary: flush accumulated text before error
+                            yield* flushTextBuffer();
+                            yield {
+                                type: 'error',
+                                error: event.message || 'Unknown Gemini error',
+                                errorType: 'unknown',
+                            };
+                            if (event.fatal) {
+                                yield { type: 'complete', result: '', isError: true, durationMs: Date.now() - startTime };
+                                done = true;
+                            }
+                            break;
+                        }
+                        default:
+                            logger.debug(`[GeminiRunner] Unknown event type: ${event.type}`);
+                    }
+                }
+                if (!done) {
+                    if (isStreamDone()) {
+                        // Boundary: flush accumulated text before exit
+                        yield* flushTextBuffer();
+                        // Process exited without result event
+                        if (exitCode !== 0) {
+                            yield { type: 'error', error: `Gemini CLI exited with code ${exitCode}`, errorType: 'unknown' };
+                        }
+                        yield { type: 'complete', result: '', isError: exitCode !== 0, durationMs: Date.now() - startTime };
+                        done = true;
+                    }
+                    else {
+                        // Wait for more data
+                        await new Promise((r) => { resolve = r; });
+                        resolve = null;
+                    }
+                }
+            }
+        }
+        finally {
+            rl.close();
+            this.activeProcesses.delete(sessionId);
+            // Kill process if still running
+            if (!child.killed && !processExited) {
+                child.kill('SIGTERM');
+            }
+            // Cleanup temp image files
+            if (tempFiles?.length) {
+                for (const f of tempFiles) {
+                    try {
+                        fs.unlinkSync(f);
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+        }
+    }
+    async recordUnattendedPolicyDenial(sessionId, toolName, requestId) {
+        const context = this.permissionContexts.get(sessionId);
+        if (context?.approvalInteractionPolicy !== 'deny')
+            return;
+        if (isGeminiUnattendedInteraction(toolName)) {
+            logger.info(`[GeminiRunner] interaction.auto_resolved kind=${normalizeGeminiToolName(toolName)} session=${sessionId}`);
+            return;
+        }
+        try {
+            await context.recordExecutionAnomaly?.({
+                code: 'runtime_permission_denied',
+                severity: 'warning',
+                phase: 'execution',
+                occurredAt: Date.now(),
+                toolName,
+                ...(requestId ? { requestId } : {}),
+                policy: context.approvalRouting?.approverPolicy ?? 'requester',
+                summary: `${toolName} runtime authorization denied by Gemini headless policy`,
+                effect: 'operation_skipped',
+            });
+        }
+        catch (error) {
+            logger.warn(`[GeminiRunner] failed to record unattended policy denial: session=${sessionId} tool=${toolName} error=${error instanceof Error ? error.message : String(error)}`);
+        }
+        logger.info(`[GeminiRunner] unattended tool approval denied: session=${sessionId} tool=${toolName}`);
+    }
+    // ── Interrupt ──
+    async interrupt(sessionKey) {
+        const child = this.activeProcesses.get(sessionKey);
+        if (child && !child.killed) {
+            child.kill('SIGINT');
+            setTimeout(() => {
+                if (!child.killed) {
+                    child.kill('SIGTERM');
+                    logger.info(`[GeminiRunner] SIGTERM fallback for: ${sessionKey}`);
+                }
+            }, 3000);
+            logger.info(`[GeminiRunner] Interrupted session: ${sessionKey} (SIGINT, SIGTERM fallback in 3s)`);
+        }
+        this.activeProcesses.delete(sessionKey);
+        this.activeStreams.delete(sessionKey);
+    }
+    // ── Session commands ──
+    updateSessionId(sessionId, agentSessionId) {
+        if (agentSessionId) {
+            this.activeSessions.set(sessionId, agentSessionId);
+        }
+        else {
+            this.activeSessions.delete(sessionId);
+        }
+        this.onSessionIdUpdate?.(sessionId, agentSessionId);
+    }
+    async closeSession(sessionId) {
+        this.activeSessions.delete(sessionId);
+        this.activeStreams.delete(sessionId);
+        this.activeProcesses.delete(sessionId);
+        this.permissionContexts.delete(sessionId);
+    }
+    resolveSessionFile(agentSessionId, projectPath) {
+        const adapter = new GeminiSessionFileAdapter();
+        return adapter.findSessionFile(projectPath, agentSessionId);
+    }
+    async clearSession(sessionId, _agentSessionId, _projectPath) {
+        // Clear = don't pass -r next time → fresh session
+        this.activeSessions.delete(sessionId);
+        return true;
+    }
+    async compactSession(_sessionId, _agentSessionId, _projectPath) {
+        logger.info('[GeminiRunner] Compact not supported, Gemini CLI handles context internally');
+        return false;
+    }
+    async compact(_sessionId, _agentSessionId, _projectPath) {
+        return this.compactSession(_sessionId, _agentSessionId, _projectPath);
+    }
+    setCompactStartCallback(_callback) { }
+    // ── Cleanup ──
+    async dispose() {
+        for (const [, child] of this.activeProcesses) {
+            if (!child.killed)
+                child.kill('SIGTERM');
+        }
+        this.activeProcesses.clear();
+        this.activeStreams.clear();
+        this.activeSessions.clear();
+        this.permissionContexts.clear();
+    }
+}
+// ── Plugin ──
+export class GeminiAgentPlugin {
+    name = 'gemini';
+    isEnabled(agent) {
+        const geminiCfg = agent.config.baseagents?.gemini;
+        if (!geminiCfg)
+            return false;
+        if (geminiCfg.cliPath)
+            return true;
+        if (geminiCfg.apiKey && !geminiCfg.apiKey.includes('your-') && !geminiCfg.apiKey.includes('placeholder'))
+            return true;
+        return commandExists('gemini');
+    }
+    createAgent(agent, callbacks) {
+        const override = agent.config.baseagents?.gemini;
+        const syntheticConfig = { agents: { gemini: override } };
+        const merged = {
+            agents: { gemini: { ...(override || {}) } },
+        };
+        return { evolagentName: agent.name, baseagent: 'gemini', agent: new GeminiRunner(merged, callbacks) };
+    }
+}